Blog · Page 4

How to build software and AI that holds up.

Guides from our engineers on custom systems, AI agents and private AI: what to build, what it costs, and what breaks once it’s live.

Security and compliance · 30 Jul 2026 · 6 min read

Your API Keys Are in the Frontend. Here Is What to Do Today.

A same-day plan for API keys shipped in client code: confirm the exposure, rotate in the right order, assess the damage, and fix the architecture that caused it.

AI agents and automation · 30 Jul 2026 · 7 min read

The Vulnerability Classes AI Code Generators Keep Producing

AI coding tools fail in patterns, not at random. These are the vulnerability classes they produce again and again — and the fastest way to find them in your own repo.

Security and compliance · 30 Jul 2026 · 7 min read

A Security Checklist for Apps You Did Not Write Line by Line

A working checklist for founders who shipped fast with an AI builder and now need to know the app is safe — every item with a way to verify it yourself.

AI agents and automation · 30 Jul 2026 · 7 min read

Prompt Injection Is Now Your Application Security Problem

If your product sends user or third-party text to a model that can call tools, prompt injection is already part of your attack surface. Here is how to contain it.

Security and compliance · 29 Jul 2026 · 6 min read

Vibe Coding Security Risks: What the 2026 Research Actually Found

What published research says about the security of AI-generated code, why the failures cluster where they do, and the fixes that address the actual findings.

AI agents and automation · 29 Jul 2026 · 6 min read

Slopsquatting: The Hallucinated Package Problem in AI Code

AI models invent package names; attackers register them and wait. Here is the mechanics of the attack, how to find hallucinated dependencies, and how to prevent them.

Engineering and operations · 29 Jul 2026 · 6 min read

AI-Built Apps That Broke in Production, and What Broke Them

Real failure patterns from AI-built apps that reached production — the symptom, the root cause underneath it, and the fix that actually held.

Security and compliance · 29 Jul 2026 · 6 min read

Row Level Security Mistakes in AI-Generated Supabase Apps

Eight Row Level Security failures we find repeatedly in AI-built Supabase apps, why the generator produces them, and the test that actually proves a policy works.

Building software · 28 Jul 2026 · 6 min read

How to Get Your Code Off Replit

Replit gives you real files, but not a portable app. Here is how to get the code out, replace the platform-specific pieces, and run it on infrastructure you own.

Building software · 28 Jul 2026 · 6 min read

How to Get Your App Out of Base44

Base44 hands you a frontend and keeps the backend. Here is what you can actually export, what has to be rebuilt, and the order that keeps the app running.

Building software · 28 Jul 2026 · 6 min read

Vendor Lock-In in AI App Builders: How to Measure It Before You Build

A practical way to score lock-in across code, data, auth, and runtime before you commit to an AI app builder — plus how to keep the exit cheap while you build.

Engineering and operations · 28 Jul 2026 · 6 min read

Self-Hosting an App You Built in an AI Builder

Moving an AI-built app onto infrastructure you control, in the order that keeps it running — plus the operational work the builder was doing for you invisibly.

AI agents and automation · 27 Jul 2026 · 6 min read

Cursor vs Claude Code for Building Something You Ship

Both work on your real repo, which puts them ahead of every builder. The difference is how much you see, how much you review, and what the codebase looks like in month three.

AI agents and automation · 27 Jul 2026 · 6 min read

Windsurf vs Cursor: Which Agentic Editor Holds Up on a Real Codebase?

Both are VS Code descendants with an agent bolted in. The difference shows up on a 60,000-line repo with conventions worth respecting — here is how each behaves.

Building software · 27 Jul 2026 · 6 min read

How to Export Your Code Out of Lovable

Getting the repo out of Lovable takes ten minutes. Getting the app to actually run somewhere else takes a bit more — here is the full list, in order.

Building software · 27 Jul 2026 · 6 min read

How to Export Your Code Out of Bolt

Getting the files out of Bolt is a button. Getting the project to build, run, and deploy on real infrastructure is the part worth reading about.

Building software · 26 Jul 2026 · 6 min read

Bolt vs v0: Picking the Right AI Builder for a Real Product

Bolt and v0 solve different halves of the same problem. Here is what each actually produces, where each stalls, and how to choose without repainting yourself into a corner.

Building software · 26 Jul 2026 · 6 min read

Base44 vs Lovable: Speed Now vs Portability Later

Base44 gives you a backend you never have to think about. Lovable gives you one you can take with you. That single difference decides most of this comparison.

Building software · 26 Jul 2026 · 6 min read

Replit vs Bolt: Agent Autonomy or Framework Control?

Replit gives an agent room to build whatever it decides you need. Bolt keeps you closer to the code. Here is which tradeoff survives contact with a real product.

Building software · 26 Jul 2026 · 6 min read

v0 vs Lovable: Frontend Polish or Full-Stack Scaffold?

v0 makes screens that look designed. Lovable makes an app that has users and a database. Choosing badly costs weeks, so here is the honest split.